[Bug c/34285] New: buffer overflow incorrectly detected

[Bug c/34285] New: buffer overflow incorrectly detected

[marcus at jet dot franken dot de]

A construct with char arrays within a struct incorrectly triggers
a buffer overflow warning.

testcase attached.


-- 
           Summary: buffer overflow incorrectly detected
           Product: gcc
           Version: 4.3.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: marcus at jet dot franken dot de
 GCC build triplet: ppc-linux-gnu
  GCC host triplet: ppc-linux-gnu
GCC target triplet: ppc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=34285

[Bug c/34285] buffer overflow incorrectly detected

[marcus at jet dot franken dot de]

------- Comment #1 from marcus at jet dot franken dot de  2007-11-29 10:37 -------
Created an attachment (id=14664)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=14664&action=view)
xx.i

gcc -O2 -Wall -c xx.i


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=34285

[Bug middle-end/34285] [4.3 Regression] buffer overflow incorrectly detected

[pinskia at gcc dot gnu dot org]

------- Comment #2 from pinskia at gcc dot gnu dot org  2007-11-29 10:42 -------
__builtin___strncpy_chk (&foo.a[0], line, 19, 10)


The issue comes down to folding of (char*)&foo into &foo.a[0], we should not be
doing that folding.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu dot
                   |                            |org
          Component|c                           |middle-end
  GCC build triplet|ppc-linux-gnu               |
   GCC host triplet|ppc-linux-gnu               |
 GCC target triplet|ppc-linux-gnu               |
           Keywords|                            |diagnostic
            Summary|buffer overflow incorrectly |[4.3 Regression] buffer
                   |detected                    |overflow incorrectly
                   |                            |detected
   Target Milestone|---                         |4.3.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=34285

[Bug middle-end/34285] [4.3 Regression] buffer overflow incorrectly detected

[mueller at gcc dot gnu dot org]

------- Comment #3 from mueller at gcc dot gnu dot org  2007-11-29 10:47 -------
fortify_source=2 is supposed to reject it (only sizeof the struct member, not
the whole struct is allowed). 

use fortify_source=1 or fix your broken code. 


-- 

mueller at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mueller at gcc dot gnu dot
                   |                            |org
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=34285

[Bug middle-end/34285] [4.3 Regression] buffer overflow incorrectly detected

[pinskia at gcc dot gnu dot org]

------- Comment #4 from pinskia at gcc dot gnu dot org  2007-11-29 11:14 -------
(In reply to comment #3)
> use fortify_source=1 or fix your broken code. 

The code is not broken as the person is accessing via the array via char and
not via a different type.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=34285

[Bug middle-end/34285] [4.3 Regression] buffer overflow incorrectly detected

[jakub at gcc dot gnu dot org]

------- Comment #5 from jakub at gcc dot gnu dot org  2007-11-29 11:25 -------
It is invalid for -D_FORTIFY_SOURCE=2.
-D_FORTIFY_SOURCE=1 allows all standard conforming code, -D_FORTIFY_SOURCE=2
imposes further restrictions (one is e.g. that %n for *printf arguments must be
only used in strings which can't be written into, one is that the str*/stp*
family of functions not only can't overflow into some other object, but can't
overflow from one struct field into another, etc.).

So, either rewrite the code using mem* functions (which even with
-D_FORTIFY_SOURCE=2 can cross field boundaries), or rewrite it to initialize
the fields individually, not in one call, or use -D_FORTIFY_SOURCE=1 instead of
-D_FORTIFY_SOURCE=2.


-- 

jakub at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=34285

[Bug middle-end/34285] [4.3 Regression] buffer overflow incorrectly detected

[pinskia at gcc dot gnu dot org]

------- Comment #6 from pinskia at gcc dot gnu dot org  2007-11-29 11:29 -------
(In reply to comment #5)
> family of functions not only can't overflow into some other object, but can't
> overflow from one struct field into another

HUH???? There is no overflow from one struct field to another here.  The
assignment is for the full struct.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=34285

[Bug middle-end/34285] [4.3 Regression] buffer overflow incorrectly detected

[mueller at gcc dot gnu dot org]

------- Comment #7 from mueller at gcc dot gnu dot org  2007-11-29 11:47 -------
Andrew, read the comments or stop reopening. the behaviour is documented that
way even. 


-- 

mueller at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=34285

[Bug middle-end/34285] buffer overflow incorrectly detected

[pinskia at gcc dot gnu dot org]

------- Comment #8 from pinskia at gcc dot gnu dot org  2007-11-29 19:27 -------
I still say GCC is incorrect here, even if I was drinking last night.  This
should work as the whole struct is touched and not even looked at the one
field.

Even if the documentation says that, it is still bad behavior.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |enhancement
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |
            Summary|[4.3 Regression] buffer     |buffer overflow incorrectly
                   |overflow incorrectly        |detected
                   |detected                    |
   Target Milestone|4.3.0                       |---


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=34285

[Bug middle-end/34285] buffer overflow incorrectly detected

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=34285

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |FIXED

--- Comment #9 from Andrew Pinski <pinskia at gcc dot gnu.org> 2012-02-02 18:26:36 UTC ---
The warning has "fixed" by the patch which changed PR 50460.